Building a more resilient Philippine enterprise in the age of AI
Cybersecurity Awareness Month arrives every October with familiar reminders to strengthen passwords, recognize phishing attempts, and protect sensitive information. But Philippine enterprises should go beyond whether employees know the basics of cyber hygiene. They also need to build the organization to withstand digital disruption.
A compromised credential can become a business interruption. A vulnerable third party can become a customer trust issue. An unmanaged application can become a data governance problem. But it isn’t just new threats that are driving cybersecurity’s shift from a purely technology concern into a broader operational matter.
The Bangko Sentral ng Pilipinas has established the Financial Cyber Resilience Governance Council to oversee implementation of its Financial Services Cyber Resilience Plan. Meanwhile, measures supporting the Anti-Financial Account Scamming Act have strengthened expectations around technology risk and fraud management. Requirements increasingly encompass real-time fraud monitoring, stronger controls for electronic financial services, bot detection, device security, and restrictions on unauthorized automation.
The message for business leaders, therefore, is that cyber resilience cannot be delegated entirely to the IT or security teams.
From awareness to resilience
A recent incident involving the official website of the Senate of the Philippines demonstrated that digital disruption is not an abstract enterprise risk. In June 2026, the Philippine Statistics Authority reported that more than 24 million Filipinos who use digital devices experienced at least one cybersecurity incident in its 2024 National Information and Communications Technology Household Survey, but less than 2% of them reached out to the authorities after the incident. These figures underscore how pervasive cyber risk has become.
Also, they illustrate that resilience in an increasingly distributed and interconnected technology environment is impossible if all that is being done is the occasional awareness initiative or periodic review. Organizations can take the lead here by embedding security and having continuous visibility into devices, applications, identities, and data.
That shift requires organizations to think about security as an ongoing operational discipline rather than a series of isolated activities. The goal is to have the visibility and controls needed to identify risks as they emerge, understand their potential impact, and respond before a security issue becomes a wider business disruption.
AI is changing the risk equation
AI adds another layer of complexity because it is entering organizations faster than many governance models can adapt. When employees use unsanctioned AI services and proprietary code, customer information or intellectual property can move beyond established controls without anyone deliberately creating a security incident.
This is why visibility is as important as policy in making adoption sustainable for the business.
Leaders need to understand what applications are being used, what data is moving through them, which devices and identities have access, and where unusual activity is occurring. Security controls that operate in isolation become harder to manage as environments grow more complex. Continuous monitoring, centralized visibility, and policy-driven enforcement can help identify shadow applications, unmanaged devices, and unauthorized automation before they become larger operational problems.
AI governance should follow the same principle. Rather than treating AI as an exceptional technology requiring an entirely separate security philosophy, organizations can bring it within existing frameworks for data protection, access control, monitoring, and accountability.
The identity perimeter is expanding
The enterprise identity perimeter is also changing. It is no longer made up solely of employees logging into applications.
Software agents, APIs, automated workflows, and AI-enabled applications can initiate actions and access information with limited human intervention. Every new connection creates another relationship that needs to be understood and governed.
This makes Zero Trust increasingly relevant. Access should be limited according to need, continuously evaluated, and constrained by context rather than granted simply because a user or device is inside a trusted environment.
Phishing-resistant authentication and granular privileged access controls can reinforce that model. If a credential is compromised, the objective should be to prevent one incident from becoming unrestricted access across the wider environment.
Making resilience part of the business
The most useful role for Cybersecurity Awareness Month may be to prompt a broader conversation about how organizations operate every day.
Resilience is not achieved by adding another training module or publishing another security policy. It comes from connecting awareness with visibility, identity with access control, data governance with AI adoption, and security monitoring with business continuity.
For Philippine enterprises, that connection is becoming more important as digital dependence deepens. Customers expect services to remain available. Employees expect technology to work securely. Regulators expect stronger accountability. Business leaders need confidence that the organization can absorb disruption without losing control of its data, operations, or customer relationships.
The objective is not to eliminate risk. In a connected economy, that is neither realistic nor particularly useful.
The real measure of resilience is what happens when something goes wrong. Can the organization see it quickly? Can it contain the impact? Can it understand what else may be affected? Can it recover without losing trust?
Those are not questions for one month of the year. They are questions about how the enterprise is designed, governed, and run.
Media Contact:
Arun Kumar
Regional Vice President of APAC
Author
